A vulnerability scanner has one intoxicating trick: it turns the invisible into a list. A forgotten server appears. An ancient software package confesses its age. A careless permission lights up red. Tenable built a large public company around that trick, beginning with Nessus, the scanner Renaud Deraison released in 1998 and carried into the company he founded with Ron Gula and Jack Huffard four years later.
Then the list became the problem. A modern enterprise can have laptops, cloud workloads, containers, web apps, industrial controllers, contractors, machine identities and employees quietly trying new AI tools. Each security product sees a piece. Each assigns a score. The result can be technically accurate and operationally ridiculous: ten thousand urgent things in a queue staffed by people who still need lunch.
Tenable’s second act is an attempt to make that queue shorter. Tenable One, launched in 2022, pulls together exposure data across IT, cloud, identity, web applications, operational technology and AI. Instead of stopping at “this machine has a critical flaw,” it tries to answer a sharper question: can an attacker use this flaw, combine it with that overpowered identity, and reach the system that runs payroll or keeps a factory moving?
The first thing that failed was the list
Nessus did not fail. It became durable enough to create the next bottleneck. The old vulnerability-management routine was to scan, grade flaws by severity, assign tickets and repeat. It worked when infrastructure changed slowly and the scan covered most of what mattered. It frayed when assets became temporary, identities became attack routes and a nominally severe bug on an isolated test box competed with a modest-looking weakness beside customer data.
That changed Tenable’s unit of value. The company still detects vulnerabilities, but its sales story has moved from the finding to the relationship between findings. Tenable One’s asset inventory attempts to establish what exists. Its attack-path analysis connects vulnerabilities, permissions and reachable systems. Its exposure views translate the technical graph into risk that a CISO can discuss with a board. Remediation tools push the chosen work toward IT teams and later check whether the fix stuck.
The platform’s core move is correlation: turn four ordinary facts into one consequential story.
This is why Tenable now calls itself an exposure-management company rather than merely a vulnerability-management vendor. A score describes a flaw. Exposure management describes a plausible way through. The distinction sounds like marketing until a team has to choose between patching 900 red alerts and breaking the three routes that lead to domain administrator privileges. Then it feels like Tuesday.
The $150 million bridge from finding to fixing
The strategy required more than relabeling Nessus. Tenable bought cloud-permissions specialist Ermetic in 2023 and cloud-data-security startup Eureka in 2024. In February 2025, it completed the purchase of Vulcan Cyber for about $148 million in cash and $2 million in restricted stock units. Vulcan brought integrations with more than 100 security products, richer prioritization and automated remediation campaigns. Tenable was paying for the connective tissue between a finding and the person who can remove it.
Three months later, Tenable announced the acquisition of Apex Security, an AI-security startup founded in 2023. The financial terms were not disclosed. Apex’s work became part of Tenable AI Exposure, which discovers enterprise AI use, looks for sensitive-data leakage and unsafe connections, and applies policies to systems such as ChatGPT Enterprise and Microsoft Copilot. The bet is consistent: a new technology surface belongs in the same risk graph as the old ones.
For buyers, the cost starts much lower than the acquisition ledger. At the time of this profile, Tenable publicly listed a one-year Tenable One Vulnerability Management subscription for 100 assets at $3,500. Large cloud, OT, identity and cross-platform deployments are quoted. That gap matters. The broad platform is aimed at organizations whose sprawl makes correlation valuable; a tiny company with a few dozen cloud assets may be buying an orchestra to play a doorbell.
“Customers are investing in Tenable One as a long-term platform to turn fragmented security data into a unified, actionable roadmap for risk reduction.”Steve Vintz, Tenable co-CEO, February 2026
Who pays to know what matters
More than 44,000 companies and government organizations use Tenable. The company says that group includes about 65 percent of the Fortune 500 and half of the Global 2000. Named customers range from Continental and Japanese banks to the City of Raleigh, healthcare providers, universities and manufacturers. That variety is not decorative. It explains why Tenable keeps adding domains: a bank’s identity graph, a software company’s cloud permissions and a utility’s industrial controllers do not look alike, but attackers happily cross the boundaries.
The daily users are vulnerability managers, cloud-security engineers, identity teams, developers and industrial-security operators. The economic buyer is often the CISO who has to make those groups share a definition of risk. This is where Tenable differs from a pure scanner. It is selling common context across teams, plus a way to report progress without reading CVE codes aloud in a board meeting.
Scale changes the product
Tenable One represented 46% of new business in 2025. The platform is no longer an appendix to the scanner story.
Its closest alternatives remain Qualys and Rapid7, the other familiar names in enterprise vulnerability management. CrowdStrike can extend endpoint telemetry into exposure management; Palo Alto Networks and Microsoft can fold similar functions into broader security estates; Wiz is formidable in cloud security. Tenable’s answer is breadth across mixed environments and a willingness to ingest third-party findings. That is useful when the estate is heterogeneous. It is less compelling when a company has already standardized on one endpoint or cloud platform and prefers its native workflow.
AI gets the clerical shift
Tenable’s first generative-AI product, ExposureAI, arrived in 2023. It could summarize attack paths in plain language and suggest mitigations. AI Aware followed in 2024 to find AI software, packages and browser plugins. AI Exposure went further in 2025, adding posture management and policy controls for enterprise AI. The sequence is neat: use AI to explain risk, find where AI itself is being used, then govern the risk that use creates.
Hexa AI, announced in March 2026 and made generally available in May, is the more consequential move. It orchestrates agents that can analyze scans, triage findings, open tickets and verify patch success. In August, Tenable began offering always-on routines for Tenable One Foundation and Advanced customers. The selling point is not a clever chat window. It is the dull, expensive coordination work that happens between “we found it” and “we fixed it.” Dull work is often where software earns its renewal.
There is an obvious condition attached: enterprises must trust the data, permissions and guardrails. An autonomous agent acting on a duplicated asset or a misunderstood industrial controller can turn efficiency into an outage. Tenable emphasizes auditability and human controls, but the product works only when integrations are complete, asset ownership is clear and remediation teams agree to accept the tickets. AI can accelerate a functioning process. It cannot negotiate the org chart.
The playbook hiding inside the product
There is a strategy here that other software companies can copy. Start with a trusted wedge that produces proprietary data. Notice the work customers perform immediately after using it. Build the next product around that adjacent job. Keep expanding only when each new data source makes the original output more valuable. Nessus remains the sensor and the brand anchor; Tenable One becomes the context and decision layer around it.
Five moves worth stealing
- Turn a report into a decision. “Here are 10,000 problems” is weaker than “start with these three.”
- Map relationships, not just objects. Context compounds when assets, identities and business systems connect.
- Buy workflow gaps selectively. Vulcan Cyber added routing and remediation, the work after detection.
- Price the wedge clearly. A public entry point lets smaller teams begin before a platform negotiation.
- Automate the repeatable middle. Let humans set policy and exceptions; let software carry context between steps.
The approach does not travel everywhere. It works best when the first product is already trusted, the adjacent data is genuinely complementary and the customer has enough complexity to value a unified view. It works poorly when integrations stay shallow, when the platform merely republishes every alert, or when teams lack the authority and budget to remediate anything. Consolidation is not a benefit by itself. Fewer consoles are useful only if they produce fewer consequential decisions.
Tenable has real evidence that customers want the new version of the company. Tenable One represented a record 46 percent of new business in 2025. Full-year revenue reached $999.4 million, up 11 percent, and the company generated $277 million in unlevered free cash flow. In the second quarter of 2026, revenue rose another 8.6 percent from a year earlier to $268.5 million. This is not a frantic pivot away from a dying product. It is a measured attempt to move up the value chain from evidence to judgment.
The cleanest version of Tenable’s pitch fits on a sticky note: finding every open door is useful; knowing which one leads to the vault is worth more. For 24 years, the company has become very good at the first job. Its future depends on whether customers trust it with the second, and whether the agents now joining the shift can close the door without slamming anyone’s fingers.